Claude Code is genuinely impressive as an interactive coding agent. But I kept running into the same wall: I wanted to use it from CI/CD pipelines, webhook automations, and security scanners — things that talk HTTP, not TTY.
Anthropic provides the Agent SDK, which is the right tool when you're embedding Claude Code into a single script. But once you need multiple clients hitting it over the network — different pipelines, different teams, each with their own API keys and workspaces — the SDK alone isn't enough. You need a service layer on top.
So I built one.
What it does
Claude Code API Server is a Python (FastAPI) service that wraps the Claude Agent SDK and exposes it as a REST API. The workflow is simple:
# 1. Upload your codebase as a ZIP
curl -X POST /v1/uploads -F "[email protected]"
# 2. Submit a job
curl -X POST /v1/jobs -d '{"upload_id": "...", "prompt": "Find security vulnerabilities"}'
# 3. Poll for results
curl /v1/jobs/{job_id}
# → status, Claude's analysis, any files it created (base64-encoded)
That's it. Fire and forget — give it a clear job, get back a complete result.
Why security was the starting point
There are projects that wrap Claude Code for network access. My concern was a step further: what happens when a malicious prompt lands in the system? A compromised CI pipeline, a rogue webhook, a prompt injection buried in a repository — the moment you expose an AI agent to the network, you have to assume this will happen. I wanted a service that treats every incoming job as potentially hostile and limits the blast radius.
Process-level sandboxing. Every job runs in a bwrap namespace with seccomp filtering. Isolated filesystem, isolated process tree — a hostile prompt can't read other jobs' data or poke around the host.
Network isolation. Per-client security profiles control what the sandbox can reach — allowlisted domains, blocked IP ranges, or full network cutoff. A prompt can't phone home if there's nowhere to call.
Separate auth layer. Server-side API keys (Argon2-hashed), completely independent from Anthropic tokens. Revoke a client without touching anyone's credentials. Cost tracking is per-client, so you always know who spent what.
Minimal footprint. No Redis, no Postgres, no message queue. One container, file-based state. Fewer components, smaller attack surface.
It also supports MCP servers and custom subagents if you need to extend Claude's capabilities — all managed through an admin API.
What it's not
This is a tool for teams, not a platform for planet-scale SaaS. No streaming, no horizontal scaling, no clustering. It comfortably handles tens of jobs per day — if you need more, scale vertically or run multiple instances.
Why I'm sharing this
I built it for my own workflows — mostly automated security reviews of merge requests. It's early (v0.1), but it works and I use it daily. I figured if it's useful to me, maybe someone else will find it useful too.
I'd genuinely love to hear what you think. Feedback, ideas on where to take it, use cases I haven't thought of, or even harsh criticism — all welcome. That's how good tools get better.